ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy

开源软件易受针对传递依赖的供应链攻击，尤其恶意代码注入NPM包。现有检测器常存在以下不足：对混淆行为的建模不充分，忽视JavaScript的面向对象特性，静态与动态分析协调不佳，以及行为抽象过程中丢失语义信息。为此，本文提出ProfMalP

历史摘要 · 未重新核验 · arXiv cs.CR

n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

CVE-2026-55608

## Summary In multi-tenant HTTP mode (`ENABLE_MULTI_TENANT=true`), an authenticated tenant could, under certain conditi

历史摘要 · 未重新核验 · GitHub Advisory

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

## Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a s

历史摘要 · 未重新核验 · GitHub Advisory

Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

CVE-2026-54335

### Impact The `_.merge(target, source)` utility exported by `@feathersjs/commons` recursively merges `source` into `ta

历史摘要 · 未重新核验 · GitHub Advisory

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

CVE-2026-54052

## Impact In multi-tenant HTTP deployments — where a single n8n-mcp server serves several tenants — the locally stored

历史摘要 · 未重新核验 · GitHub Advisory

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

CVE-2026-50131

### Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL valida

历史摘要 · 未重新核验 · GitHub Advisory

SafeInstall agent guard shell parsing can miss raw package execution

## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in it

历史摘要 · 未重新核验 · GitHub Advisory

tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

CVE-2026-49977

### Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with dat

历史摘要 · 未重新核验 · GitHub Advisory

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

CVE-2026-49866

### Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously be

历史摘要 · 未重新核验 · GitHub Advisory

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

CVE-2026-5078

### Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it

历史摘要 · 未重新核验 · GitHub Advisory

Waku has an Open Redirect via `unstable_redirect` Helper

CVE-2026-49456

## Summary The `unstable_redirect()` helper exported from `waku/router/server` (`packages/waku/src/router/define-router

历史摘要 · 未重新核验 · GitHub Advisory

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

CVE-2026-49455

## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetc

历史摘要 · 未重新核验 · GitHub Advisory

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

### Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `better

历史摘要 · 未重新核验 · GitHub Advisory

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

CVE-2026-53518

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth

历史摘要 · 未重新核验 · GitHub Advisory

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

CVE-2026-53513

### Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

CVE-2026-53517

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a ve

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

### Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enab

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

CVE-2026-53516

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a ve

历史摘要 · 未重新核验 · GitHub Advisory